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« The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )S Responsive to communication(s) filed on 28 August 2006 . 
2a)t3 This action is FINAL. 2b)D This action is non-final. 

3) Q Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quay/e, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) KI Claim(s) 7-58 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) ^ Claim(s) 1-58 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)Q objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

20 Certified copies of the priority documents have been received in Application No. . 

3.Q Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attachment(s) 

1 ) ^ Notice of References Cited (PTO-892) 

2) O Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) □ Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 

Paper No(s)/Mail Date . 



4)|2SI Interview Summary (PTO-41 3) 
Paper No(s)/Mail Date. . 

5) 



Notice of Informal Patent Application (PTO-152) 



6) U Other: 



U.S. Patent and Trademark Office 
PTOL-326 (Rev. 7-05) 
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DETAILED ACTION 
Interview 

1. The reply filed on 12/20/05 is not fully responsive because it fails to include a complete 
or accurate record of the substance of the December, 2005 interview. The applicant's interview 
summary from 12/20/05 is insufficient pursuant to MPEP 713.04 since it does not include all of 
the applicable items (A through H) that must be included in a complete and proper recordation of 
an interview. See MPEP 713.04. For example, the Applicant's interview summary does not 
identify the general thrust of the principal arguments made by either the attorney or the 
examiner. It is not evident from the record why the applicants would have added further detail to 
claim 58. The response to this office action must include a summary of the December, 2005 
interview in accordance with MPEP 713.04. 

2. The amendments filed 12/20/05 and 8/28/06 have been entered. 

Claim Rejections - 35 USC 102 
1 . The following is a quotation of the appropriate paragraphs of 35 U. S.C. 102(e) that form 
the basis for the rejections under this section made in this Office action: 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 



Application/Control Number: 09/706,503 Page 3 

Art Unit: 2142 

1 . Claims 1-39, 42-43, 45-48, 51-52, 54-58 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Malan et al. with U.S. Patent App. Pub. 2002/0032871. U.S. Provisional App. 
No. 60/231,481 is incorporated by reference into Malan (par. 1). 

1. Regarding claim 1, Malan describes a computer system (Fig. 7 elem. 17) located in one 
zone of an ISP network launching a denial of service attack against another computer system 
(Fig. 7 elem. 16) in a zone of another ISP network (pars. 80-82). Malan anticipates the claimed 
invention by disclosing a network comprising: 

2. A first network domain which is a local area network (Fig. 7 LAN that DOS source elem. 
17 is on; par. 59 describing how ISP-2 network is structured in the same manner as ISP-1); 

3. A first routing device at a boundary between the local area network and public 
internetworking fabric to route network traffic between the network domain and the public 
internetworking fabric (Fig. 7 elem. 20d); 

4. A monitor/regulator (Fig. 7 elems. 20c and 24b collector/controller), either integrally 
disposed in said first routing device (par. 87 showing integration) or coupled to the first routing 
device (Fig. 7 elem, 20d) to monitor the network traffic routed by said first routing device by 
analyzing flow records (pars. 66 & 71), describing traffic conversation as indicated by a 
combination of source and destination addresses (par. 71), received from the routing device, the 
monitor/regulator determining if the first network domain is sourcing undesirable network 
traffic, comprising a denial of service attack in which the undesirable network traffic is launched 
against a target network device in order to undermine the operation of that target network device 
by overwhelming the target network device with network traffic, out of the first network domain 
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(60/231,481 p. 8 as scanned, p. 10 as labeled - describing the detection of a denial of service 
attack within the attacker's originating network/source network). 

5. Regarding claim 14, it is a method claim corresponding to apparatus claim 1, and it is 
anticipated by Malan for the same reasons. 

6. Regarding claim 27, it is an apparatus claim directed to a processor and a storage medium 
including instructions for performing the method of claim 14. Since the reasons for rejection are 
readily apparent from the discussion of claim 14, above, they will not be repeated. 

7. Regarding claim 58, it is an apparatus claim containing limitations directed to a network 
domain, a routing device, and a monitor/regulator as addressed in claim 1 above. However, 
claim 58 includes the additional limitations of (a) the monitor/regulator generating statistics 
concerning destination addresses to determine whether the network domain is sourcing the 
undesirable traffic and (b) the It is noted that Malan teaches these additional features. Malan 
teaches generating statistics concerning destination addresses to determine whether the network 
domain is sourcing the undesirable traffic (pars. 70-71). Malan teaches a monitor/regulator that 
instructs the routing device to lower a priority of the undesirable network traffic and/or slow the 
undesirable network traffic (60/231,481 pp. 10-1 1 as scanned, pp. 12-13 as labeled - describing 
how StormBreaker slows attack traffic to zero; Malan par. 79 showing CAR limiters). 

1 . Regarding claim(s) 2, 1 5, 28, Malan teaches the monitor makes said determination is 
based on differential characteristics of traffic routed in and out, par. 66 and 71. 

2. Regarding claim(s) 3, 16, 29, 42, 51, Malan teach aggregated statistics of traffic data, par. 
71. 



Application/Control Number: 09/706,503 Page 5 

Art Unit: 2142 

3. Regarding claims 4, 17, 30, Malan teaches aggregating said input and output 
characteristics, par. 71. 

4. Regarding claim(s) 5, 9, 13, 18, 22, 26, 31, 35, 39, Malan teaches stopping undesirable 
traffic being sourced, par. 79. 

5. Regarding claim(s) 6, 10, 19, 23, 32, 36, Malan teaches a second routing device or 
network domain through which undesirable traffic is determined as "other router systems", par. 
61 and 71. 

6. Regarding claim(s) 7-8, 1 1-12, 20-21, 24-25, 33-34, 37-38, Malan teaches detecting 
undesirable traffic between routers as "source ports", par. 71. 

7. Regarding claim(s) 43, 52, Malan teaches determining if sourcing of undesirable 
traffic/flow based on statistics such as packet lengths, par. 70. 

8. Regarding claim(s) 45, 54, Malan teaches determining if sourcing of undesirable 
traffic/flow based on statistics such as TCP SYN and FIN packets, par. 83. 

8. Regarding claim(s) 46-47, 55-56, Malan teaches slowing or lowing priority of 
traffic(60/23 1,481 pp. 10-1 1 as scanned, pp. 12-13 as labeled - describing how StormBreaker 
slows attack traffic to zero; Malan par. 79 showing CAR limiters). 

9. Regarding claim(s) 48, 57, Malan teaches priority levels as groups/categories, par. 68, 70. 

Claim Rejections - 35 USC3103 
9. This application currently names joint inventors. In considering patentability of the 
claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the various 
claims was commonly owned at the time any inventions covered therein were made absent any 



Application/Control Number: 09/706,503 Page 6 

Art Unit: 2142 

evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out 
the inventor and invention dates of each claim that was not commonly owned at the time a later 
invention was made in order for the examiner to consider the applicability of 35 U.S.C. 1038 and 
potential 35 U.S.C. 102(f) or (g) prior art under 35 U.S.C. 103(a). 
10. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 102 of this title, if the differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

10. Claims 44, 53 are rejected under 35 U.S.C. 103(a) as being unpatentable over Malan et al. 
with U.S. Patent App. Pub. 2002/0032871. 

1 1 . Regarding claim 44, 53, the Malan patent discloses the method of the preceding claims. 
The Malan patent does not explicitly disclose all the details relating to specific types of statistic 
such as TTL. However, Official Notice is taken MPEP 2144.03 (a)) that details relating to 
specific types of statistics is well known in the art to insure a complete data set. It would have 
been obvious to one of ordinary skill in the art at the time of the application's invention to 
provide details relating to specific types of statistics to obtain the advantages of having a 
complete data set. By the above rational, the claim is rejected. 



Response to Amendment 
2. Applicant's arguments with respect to the rejection(s) of the claim(s) have been fully 
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considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon 
further consideration, a new ground(s) of rejection is made. 

Conclusion 

11. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure is disclosed in the Notice of References Cited. 

3. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

4. A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 

CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

5. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Stephan Willett whose telephone number is (571)272-3890. The 
examiner can normally be reached Monday through Friday from 8:00 AM to 6:00 PM. 

1 . If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell, can be reached on (571)272-3868. The fax phone number for the 
organization where this application or proceeding is assigned is (571)273-8300. 
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6. Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (571) 272-2100. 



sfw 



; ~W CALDWELL 

September 5, 2006 @y, ^ oVIBORY PATENT EXAMINER 



